The Privacy Advisor Podcast

For those following along with digital policy in Canada, the last few weeks have been chock full of developments. In early June, the Canadian government introduced its AI for All strategy, aimed at driving economic growth, bolstering digital sovereignty and increasing trust and safety.    The government also released Bill C-34 - the Safe Social Media Act, which would ban children under age 16 from...

As artificial intelligence marches its steady pace into our day-to-day lives, the safety and privacy of children online continues to be a major concern for several governments and legislatures around the world. Australia became the first country that requires platforms to take reasonable steps to prevent children under 16 from accessing social media platforms ; nearly a dozen nations have since co...

The complexity and significance of international data flows have long been one of the major issues for privacy and digital responsibility professionals. In the last decade, two major frameworks - the EU-US Safe Harbor and EU-US Privacy Shield agreements - were both invalidated by the Court of Justice of the European Union. The EU-US Data Privacy Framework, however, remains intact, though it has fa...

It's no secret that large language models and artificial intelligence systems require massive amounts of data, which often runs up against fundamental privacy principles like purpose limitation and data minimization. Privacy and data protection laws - like the EU General Data Protection Regulation - feature concepts like the right to be forgotten and data subject access requests. But these are oft...

The Asia-Pacific region is home to more than half the world's population - at 60% - with approximately 4.75 billion people. In recent years, India and Vietnam, to name just two, have enacted comprehensive data protection laws. Near the end of 2025, India finalized its highly anticipated regulations for the Digital Personal Data Protection Act and Vietnam's Personal Data Protection Law became effec...

  The California Privacy Protection Agency was formed six years ago as mandated by the California Privacy Rights Act. As the first dedicated privacy regulator in the U.S., CalPrivacy - as it's called colloquially - implements and enforces both the CPRA and California Consumer Privacy Act. Under the state's Delete Act, it also oversees California's data broker registry and the Delete Request and Op...

Goodwin Partner Omer Tene has long had his finger on the pulse of privacy and AI governance developments and trends. He advises clients on a wide range of issues, from data protection, artificial intelligence, technology, cybersecurity and beyond. As we head into a brave new 2026, IAPP Editorial Director Jedidiah Bracy caught up with Tene to discuss the big issues he sees playing out this year, fr...

On November 19, the European Commission unveiled two major omnibus packages as part of its European Data Union Strategy. One package proposes several changes to the EU General Data Protection Regulation, while the other proposes significant changes to the recently minted EU AI Act, including a proposed delay to the regulation of so-called high-risk AI systems.    Laura Caroli was a lead negotiator...

Lorrie Cranor has long been a leader in the privacy space. As Director and Bosch Distinguished Prof. in Security and Privacy Technologies at Carnegie Mellon's CyLab Security and Privacy Institute, Prof. Cranor is on the cutting edge of usable privacy and security. Her work has influenced researchers to view privacy as a fundamental design standard rather than an abstract ideal and has helped resha...

Anu Talus was elected Chair of the European Data Protection Board in May of 2023. The EDPB, which was established in 2018, ensures that the EU General Data Protection Regulation and Data Protection Law Enforcement Directive are consistently applied in the EU. It also provides general GDPR guidance, adopts findings to ensure the GDPR is implemented consistently across member nations, advises the Eu...

As artificial intelligence continues to coalesce in the modern economy, AI governance only grows in significance. Brenda Leong, director of ZwillGen's AI division, and Andrew Burt, CEO of Luminos, have long been on the front lines of AI's emergence and busy helping organizations navigate this space.    In a first for The Privacy Advisor Podcast, we're featuring a guest host, my colleague Alex LaCa...

On 4 Sept., the Court of Justice of the European Union gave its highly anticipated decision in the EDPS v. SRB case. In its landmark ruling, the CJEU clarified the definition of personal data under the EU General Data Protection Regulation, and, in essence, the scope of EU data protection law. For Ulrich Baumgartner, a partner at Baumgartner Baumann and IAPP Country Leader for the DACH region, the...

Ruby Zefo has long been a leader in the fields of privacy, data protection and cybersecurity. She was the first chief privacy officer at Uber, where she served from 2018, helping lead the company's efforts to protect and enable user data. She has done so while Uber continues to innovate its technology amid a dramatic increase in digital laws around the world. Earlier this year, Zefo announced her...

Nearly a year ago, the IAPP expanded its mission in response to a rapidly changing digital environment to include AI governance, digital responsibility and cybersecurity law. The mission expansion took place a year after the IAPP hired Ashley Casovan to lead its first-ever AI Governance Center. Since then, Casovan has led the development of the center, which includes work helping to inform AI gove...

As the privacy profession surpasses the quarter-century mark and enters into a brave new world of artificial intelligence and digital entropy, it's worth taking a look back to assess how far the profession has come. That's exactly what long-time privacy pro Stephen Bolinger embarked upon when he decided to film a documentary on the rise of the privacy profession. "Privacy People" explores the veri...

As chief privacy officer of the biggest city in the United States, it's safe to say that Michael Fitzpatrick doesn't have your normal, run-of-the-mill job. As part of New York's Office of Technology and Innovation, the Office of Information Privacy provides guidance to more than 175 agency privacy officers across the city. It also works closely with the city's Cyber Command and has partnered with...

Autonomous robots with embedded artificial intelligence are growing more common across industry sectors. So-called "embodied AI," collects vast amounts of data through its sensors and changes how humans interact with technology. As embodied AI becomes more common and continues to drive innovation, it also creates new challenges for ethical uses of data and personal privacy. Erin Relford is a priva...

Privacy law and technological advancements have a deep and intertwined history that go back to at least the 1890s with Samuel Warren and Louis Brandeis's article "The Right to Privacy," which was prompted by camera technology. George Washington University Law Professor Dan Solove has long studied and written about privacy law. He published several well-known books including "Nothing to Hide: The F...

Australia made waves in 2024 after it passed an amendment to the Online Safety Act of 2021, which introduces a legal minimum age of 16 to create and use an account for certain social media platforms in Australia. It also requires platforms within scope to implement age-gating practices. As Australia's first eSafety Commissioner,  Julie Inman - Grant , whose agency administers the Online Safety Act...

Though it came close in recent years, federal privacy legislation is not likely top of mind as a new administration takes the reigns in Washington, DC. The same likely goes for federal AI governance and safety legislation with a divided Congress and executive branch that promotes a deregulatory posture. That means state-level privacy and AI bills will proliferate in 2025. Connecticut was the 5th U...

It's hard to believe we've reached the final weeks of 2024, a year filled with policy and legal developments across the map. From the continued emergence of AI governance, to location privacy enforcement, children's online safety to novel forms of privacy litigation, no doubt this was a year that kept privacy and AI governance pros very busy. One such professional in the space is Goodwin Partner O...

  AI governance is a rapidly evolving field that faces a wide array of risks, challenges and opportunities. For organizations looking to leverage AI systems such as large language models and generative AI, assessing risk prior to deployment is a must. One technique that's been borrowed from the security space is red teaming. The practice is growing, and regulators are taking notice. Brenda Leong,...

As the U.S. enters the final stretch of the 2024 election cycle, we face a tight race at the presidential and congressional levels. With a razor-thin margin separating Vice President Kamala Harris and former president Donald Trump, we decided to take a look at the possible policy positions of each campaign with regard to privacy and artificial intelligence governance. Of course, reading tea leaves...

The year 2024 proved to be another robust one for emerging U.S. state privacy law. Seven states joined the ranks, bringing the total up to 19.   Unlike previous years, however, 2024 underwent a paradigm shift away from the standard framework influenced by the draft Washington State Privacy Act. For the Future of Privacy Forum's Keir Lamont, CIPP/US, and Husch Blackwell's David Stauss, CIPP/E, CIPP...

In May 2024, the U.S. National Institute for Standards and Technology launched a new program called ARIA, which is short for Assessing Risks and Impacts of AI. The aim of the program is to advance sociotechnical testing and evaluation of artificial intelligence by developing methods to quantify how a given system works within real-world contexts. Potential outputs include scalable guidelines, tool...